1. Technical Field
The present invention relates to data processing and, in particular, to administration in a computer network. Still more particularly, the present invention provides a method, apparatus, and program for administration of managed resources using access control lists.
2. Description of Related Art
A resource manager software manages resources in a network. Many operating systems provide resource management for very low level resources, such as files and folders. These resources may be managed using access control lists that define users and groups of users and the operations that are permitted for those users and groups of users. However, these permissions are hard coded into the operating system and are limited to permissions associated with files and folders, such as read, write, create, and delete. In order to provide resource management on a higher level, management server software is typically developed to enforce administration models.
Most administration models today revolve around defining a role for a particular administrator and then associating a number of tasks that a person with that role is permitted to perform. This is limiting in that only a limited number of roles can be defined. All administrators must be pigeon holed into one role or another. Furthermore, the task list is static and hard coded into the management server software. It also has a security exposure, because once an administrator is logged in with a specific group privilege, revoking the privilege is not possible until the login is terminated.
Therefore, it would be advantageous to provide an improved administration model in which the permission sets are not predefined and can be customized based on the resource being administered.